[SECURITY] [DSA 3644-1] fontconfig security update

2016-08-0816:36:46

lists.debian.org

0.0004 Low

EPSS

Percentile

5.1%

JSON

Debian Security Advisory DSA-3644-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
August 08, 2016 https://www.debian.org/security/faq

Package : fontconfig
CVE ID : CVE-2016-5384
Debian Bug : 833570

Tobias Stoeckmann discovered that cache files are insufficiently
validated in fontconfig, a generic font configuration library. An
attacker can trigger arbitrary free() calls, which in turn allows double
free attacks and therefore arbitrary code execution. In combination with
setuid binaries using crafted cache files, this could allow privilege
escalation.

For the stable distribution (jessie), this problem has been fixed in
version 2.11.0-6.3+deb8u1.

For the unstable distribution (sid), this problem has been fixed in
version 2.11.0-6.5.

We recommend that you upgrade your fontconfig packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8powerpclibfontconfig1< 2.11.0-6.3+deb8u1libfontconfig1_2.11.0-6.3+deb8u1_powerpc.deb
Debian8kfreebsd-i386fontconfig-udeb< 2.11.0-6.3+deb8u1fontconfig-udeb_2.11.0-6.3+deb8u1_kfreebsd-i386.deb
Debian8kfreebsd-amd64libfontconfig1-dev< 2.11.0-6.3+deb8u1libfontconfig1-dev_2.11.0-6.3+deb8u1_kfreebsd-amd64.deb
Debian8s390xlibfontconfig1-dev< 2.11.0-6.3+deb8u1libfontconfig1-dev_2.11.0-6.3+deb8u1_s390x.deb
Debian8amd64fontconfig< 2.11.0-6.3+deb8u1fontconfig_2.11.0-6.3+deb8u1_amd64.deb
Debian7allfontconfig-config< 2.9.0-7.1+deb7u1fontconfig-config_2.9.0-7.1+deb7u1_all.deb
Debian8kfreebsd-i386libfontconfig1< 2.11.0-6.3+deb8u1libfontconfig1_2.11.0-6.3+deb8u1_kfreebsd-i386.deb
Debian8s390xlibfontconfig1-dbg< 2.11.0-6.3+deb8u1libfontconfig1-dbg_2.11.0-6.3+deb8u1_s390x.deb
Debian8powerpcfontconfig-udeb< 2.11.0-6.3+deb8u1fontconfig-udeb_2.11.0-6.3+deb8u1_powerpc.deb
Debian8ppc64ellibfontconfig1< 2.11.0-6.3+deb8u1libfontconfig1_2.11.0-6.3+deb8u1_ppc64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	powerpc	libfontconfig1	< 2.11.0-6.3+deb8u1	libfontconfig1_2.11.0-6.3+deb8u1_powerpc.deb
Debian	8	kfreebsd-i386	fontconfig-udeb	< 2.11.0-6.3+deb8u1	fontconfig-udeb_2.11.0-6.3+deb8u1_kfreebsd-i386.deb
Debian	8	kfreebsd-amd64	libfontconfig1-dev	< 2.11.0-6.3+deb8u1	libfontconfig1-dev_2.11.0-6.3+deb8u1_kfreebsd-amd64.deb
Debian	8	s390x	libfontconfig1-dev	< 2.11.0-6.3+deb8u1	libfontconfig1-dev_2.11.0-6.3+deb8u1_s390x.deb
Debian	8	amd64	fontconfig	< 2.11.0-6.3+deb8u1	fontconfig_2.11.0-6.3+deb8u1_amd64.deb
Debian	7	all	fontconfig-config	< 2.9.0-7.1+deb7u1	fontconfig-config_2.9.0-7.1+deb7u1_all.deb
Debian	8	kfreebsd-i386	libfontconfig1	< 2.11.0-6.3+deb8u1	libfontconfig1_2.11.0-6.3+deb8u1_kfreebsd-i386.deb
Debian	8	s390x	libfontconfig1-dbg	< 2.11.0-6.3+deb8u1	libfontconfig1-dbg_2.11.0-6.3+deb8u1_s390x.deb
Debian	8	powerpc	fontconfig-udeb	< 2.11.0-6.3+deb8u1	fontconfig-udeb_2.11.0-6.3+deb8u1_powerpc.deb
Debian	8	ppc64el	libfontconfig1	< 2.11.0-6.3+deb8u1	libfontconfig1_2.11.0-6.3+deb8u1_ppc64el.deb